If Canva is sold or merges with another company, your personal data may be transferred to the new owner, with notification provided by email or site notice before any change in privacy policy applies.
This analysis describes what Canva's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes transfer of user personal data to third parties in the context of a corporate transaction. The notice commitment provides some protection, but the practical ability of users to withdraw consent or delete data prior to a transfer depends on response timelines and how notice is delivered.
The updated privacy policy no longer explicitly discloses that Canva uses cookies to personalize ads, analyze website performance, or tailor content on partner sites. Previously, the policy stated these purposes and directed users to the cookie policy for more information and choice. The revised policy now mentions only that essential cookies are used to make Canva work. This change removes transparency about non-essential cookie uses and eliminates the cookie consent interface (Accept all cookies / Manage cookies buttons) that was previously presented in the privacy policy document itself.
View change record →The updated privacy policy no longer includes explicit language describing Canva's use of non-essential cookies for personalization, advertising tailoring, and website analytics. Previously, the policy stated that Canva would use these cookies only if users accepted. The removal of this disclosure means the policy no longer clearly explains these cookie categories or presents a consent interaction for non-essential cookies at the point where this information was previously disclosed. Depending on applicable cookie law and Canva's implementation, users may need to consult additional documentation such as a separate cookie policy to understand how non-essential cookies are managed.
View change record →The updated privacy policy no longer explicitly discloses optional cookie uses or provides cookie preference controls on the privacy policy page itself. Previously, Canva stated it would use non-essential cookies for personalization, ad targeting, and analytics only if users accepted, and offered 'Accept all cookies' and 'Manage cookies' options. The removal of this disclosure and consent mechanism may affect how users understand cookie practices and when consent is obtained. Users who previously accessed cookie preferences through the privacy policy will need to locate these controls elsewhere on the Canva platform if they remain available.
View change record →In the event of a merger or acquisition involving Canva, your personal data including account information, designs, and usage history could transfer to a new corporate entity. The policy states Canva will notify users by email or site notice before a different privacy policy applies.
How other platforms handle this
Skillshare recently acquired the main operating assets of Superpeer. This Privacy Policy now applies to the use of Superpeer as well as Skillshare. For any questions about the acquisition, please contact us at privacy@skillshare.com.
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
Monitoring
Canva has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If Canva is involved in a merger, acquisition, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website prior to your information becoming subject to a different privacy policy.— Excerpt from Canva's Canva Privacy Policy
REGULATORY LANDSCAPE: Business transfer data sharing implicates GDPR Article 6 lawful basis requirements, as a corporate transaction does not automatically provide a lawful basis for continued processing under a new entity's terms. CCPA requires that consumers be notified of material changes to data use arising from business transfers. The FTC Act applies to deceptive representations about what happens to consumer data in transactions. GOVERNANCE EXPOSURE: Medium. Business transfer provisions are standard in privacy policies, but the adequacy of notice and the option available to users to object or delete prior to transfer are operationally significant. The policy commits to notification but does not specify a notice period or guarantee a right to delete before transfer occurs. JURISDICTION FLAGS: EU and UK users have GDPR rights to object to processing changes arising from business transfers, and the new controller would need to establish an independent lawful basis for continued processing. California users have rights under CCPA to be notified of material changes to data use practices. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers with DPAs in place should verify what obligations Canva has to notify controller-customers in the event of a business transfer affecting data processing arrangements, and whether sub-processor change notification requirements apply. COMPLIANCE CONSIDERATIONS: Compliance teams should ensure they maintain current email contact information registered with Canva to receive transaction notices. In the event of a Canva acquisition, legal teams should assess whether the new entity's privacy practices require a new DPA or contractual amendment for enterprise accounts.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes transfer of user personal data to third parties in the context of a corporate transaction. The notice commitment provides some protection, but the practical ability of users to withdraw consent or delete data prior to a transfer depends on response timelines and how notice is delivered.
In the event of a merger or acquisition involving Canva, your personal data including account information, designs, and usage history could transfer to a new corporate entity. The policy states Canva will notify users by email or site notice before a different privacy policy applies.
ConductAtlas has identified this type of provision across 1 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Canva.